 (def cacrl (str cadir "/ca_crl.pem"))
 (def csrdir (str cadir "/requests"))
 (def signeddir (str cadir "/signed"))
+
+(defn assert-subject [o subject]
+  (is (= subject (-> o .getSubjectX500Principal .getName))))
+
+(defn assert-issuer [o issuer]
+  (is (= issuer (-> o .getIssuerX500Principal .getName))))
 
 (deftest get-certificate-test
   (testing "returns CA certificate when subject is 'ca'"


        (testing "requests are autosigned and saved to disk"
          (is (fs/exists? expected-cert-path))
          (let [signed-cert (utils/pem->cert expected-cert-path)
                subject     (-> signed-cert .getSubjectX500Principal .getName)
                issuer      (-> signed-cert .getIssuerX500Principal .getName)]
            (is (= "CN=test-agent" subject))
            (is (= "CN=test ca" issuer))))

        (testing "cert expiration is correct based on Puppet's ca_ttl setting"
          (let [duration (Period. now expiration)]


(deftest get-certificate-revocation-list-test
  (testing "`get-certificate-revocation-list` returns a valid CRL file."
    (let [crl (-> (get-certificate-revocation-list cacrl)
                  StringReader.
                  utils/pem->crl)]
      (assert-issuer crl "CN=Puppet CA: localhost"))))

(let [ssldir          (ks/temp-dir)
      cadir           (str ssldir "/ca")
